I write systemd services that launch with root privileges and de-privilege themselves to a system account (called mxdaemon). These services require access to the physical serial port (/dev/ttyS0) on the PC. Serial port ls -l:

Serial port: crw-rw---- 1 root dialout 4, 64 Jun 13 22:00 /dev/ttyS0

When run as root, the service has no problem communicating via the serial port.
When the service is configured to de-privilege to mxdaemon, I get a permission denied error when attempting to access /dev/ttyS0.

mxdaemon is a member of both the dialout & tty groups:

mxdaemon : mxdaemon dialout tty

Even after logging out and/or rebooting the PC, I still get permission denied for ANY user besides root.

Hours of scouring the Internet suggest that everything is configured correctly.